integration: v0.14.0-rc0

CLAUDE.md

@@ -227,7 +227,7 @@ obol sell delete ollama-gated -n llm
 
 ## RPC Gateway
 
-`obol network add|remove|status` manages remote RPCs via eRPC ConfigMap. Default: read-only (blocks `eth_sendRawTransaction`, `eth_sendTransaction`). `--allow-writes` flips readOnly → route `eth_sendRawTransaction` to the user-chosen upstream via eRPC per-method selection policy. `--endpoint` adds a custom RPC directly (skips ChainList). Key functions in `internal/network/rpc.go`: `AddPublicRPCs()` (ChainList), `AddCustomRPC()`, `ListRPCNetworks()`. Record-on-write: add/remove update `$CONFIG_DIR/rpc/recorded-upstreams.yaml` (`internal/network/record.go`); `obol stack up` replays via `ReconcileRecordedRPCs()` so remote RPCs survive cluster recreation. Local-node upstreams are NOT recorded (`network sync` re-registers them).
+`obol network add|remove|status` manages remote RPCs via eRPC ConfigMap. Default: read-only (blocks `eth_sendRawTransaction`, `eth_sendTransaction`). `--allow-writes` flips readOnly → route `eth_sendRawTransaction` to the user-chosen upstream via eRPC per-method selection policy. `--endpoint` adds a custom RPC directly (skips ChainList). Key functions in `internal/network/rpc.go`: `AddPublicRPCs()` (ChainList), `AddCustomRPC()`, `ListRPCNetworks()`. Record-on-write: add/remove update `$CONFIG_DIR/rpc/recorded-upstreams.yaml` (`internal/network/record.go`); `obol stack up` replays via `ReconcileRecordedRPCs()` so remote RPCs survive cluster recreation. Local-node upstreams are NOT recorded (`network sync` re-registers them). **Durable eRPC operator config** (so local baskets are not lost on stack up): `obol network erpc set|status|reset` persists `$CONFIG_DIR/rpc/erpc-overlay.yaml` (merge-by-id into the live ConfigMap; not a full replace) and re-applies after recorded remotes on stack up via `ReconcileERPCOverlay()` (`internal/network/overlay.go`, #763). Example: `examples/erpc-overlay-hyperevm.yaml`.
 
 ## Network Management
 
@@ -242,7 +242,7 @@ Two-stage templating: `values.yaml.gotmpl` annotated with `@enum`/`@default`/`@d
 | Command | Action |
 |---------|--------|
 | `obol stack init` | Generate cluster ID (petname), resolve absolute paths, write k3d.yaml, copy infrastructure |
-| `obol stack up` | `k3d cluster create`, export kubeconfig, k3s auto-applies manifests, auto-configures LiteLLM with Ollama models (preserves Ollama modified-time order; `:cloud` aliases demoted behind local chat models; embedding-only models last; warns + suggests `ollama pull qwen3.5:4b` when empty or all-`:cloud`), re-imposes recorded model config (`model.ReconcileRecorded` — operator's `obol model` choices win over auto-detect), deploys default Hermes agent, applies agent capabilities, starts persistent Cloudflare tunnel, then replays recorded state: RPC upstreams (`network.ReconcileRecordedRPCs`) → Agent CRs (`agentcrd.ResumeAll`) → sell offers (`resumeSellOffers`; agent-type offers ride the sell-http store). Guard: `cmd/obol/stackup_resume_guard_test.go` |
+| `obol stack up` | `k3d cluster create`, export kubeconfig, k3s auto-applies manifests, auto-configures LiteLLM with Ollama models (preserves Ollama modified-time order; `:cloud` aliases demoted behind local chat models; embedding-only models last; warns + suggests `ollama pull qwen3.5:4b` when empty or all-`:cloud`), re-imposes recorded model config (`model.ReconcileRecorded` — operator's `obol model` choices win over auto-detect), deploys default Hermes agent, applies agent capabilities, starts persistent Cloudflare tunnel, then replays recorded state: RPC upstreams (`network.ReconcileRecordedRPCs`) → eRPC operator overlay (`network.ReconcileERPCOverlay`) → Agent CRs (`agentcrd.ResumeAll`) → sell offers (`resumeSellOffers`; agent-type offers ride the sell-http store). Guard: `cmd/obol/stackup_resume_guard_test.go` |
 | `obol stack down` | `k3d cluster stop` (delete fallback; preserves config + data) |
 | `obol stack purge [-f]` | Delete config; `-f` also deletes root-owned PVCs; `-f` offers a full `stack export` first (fallback: OpenClaw wallet prompt) |
 | `obol stack export` | Full backup archive: config dir (minus kubeconfig/defaults), agent data dirs (brains + keystores, deployments quiesced for consistency), encrypted wallet backups, etcd-drift resources (Agent CRs, ServiceOffers, LiteLLM/eRPC CMs). `internal/stackbackup/` |

README.md

@@ -34,15 +34,33 @@ Built on [Kubernetes](https://kubernetes.io) with [Helm](https://helm.sh/) for p
 - **Linux**: [Docker Engine installation guide](https://docs.docker.com/engine/install/)
 - **macOS/Windows**: [Docker Desktop](https://docs.docker.com/desktop/)
 
-For local models, install [Ollama](https://ollama.com) and pull at least one chat-capable model (e.g. `ollama pull qwen3:8b`). Skip this if you'll use a cloud provider (see [Models](#models)).
+For local models, install [Ollama](https://ollama.com) and pull at least one chat-capable model (e.g. `ollama pull qwen3.5:4b`). The installer may offer to install Ollama; **if you decline and do not configure a cloud model**, `obol stack up` **skips the default Hermes agent** until you run `obol model setup` and then `obol agent init`. Prefer a cloud provider anytime with `obol model setup` (see [Models](#models)).
 
 ### Install
 
 ```bash
 bash <(curl -fsSL https://stack.obol.org)
 ```
 
-The installer sets up the `obol` CLI and all dependencies (`kubectl`, `helm`, `k3d`, `helmfile`, `k9s`) into `~/.local/bin/`, verifies release checksums, configures your PATH, and offers to start the cluster.
+Pin a release (use the current tag from the [releases page](https://github.com/ObolNetwork/obol-stack/releases), not an ancient example):
+
+```bash
+OBOL_RELEASE=v0.13.0 bash <(curl -fsSL https://stack.obol.org)
+```
+
+The installer sets up the `obol` CLI and all dependencies (`kubectl`, `helm`, `k3d`, `helmfile`, `k9s`) into `~/.local/bin/`, verifies release checksums, configures your PATH, tries to add `obol.stack` to `/etc/hosts`, and offers to start the cluster.
+
+If `/etc/hosts` cannot be updated (no sudo / you cancel), the install still finishes — add the host, then start the stack yourself:
+
+```bash
+echo "127.0.0.1 obol.stack" | sudo tee -a /etc/hosts
+# After stack up, agent hostnames are also managed (obol-agent.obol.stack, …)
+obol stack init
+obol stack up
+obol agent init   # if the default agent was skipped (no model yet)
+```
+
+Non-interactive / CI: set `OBOL_NONINTERACTIVE=true` so hosts updates do not prompt for a sudo password (they fail fast if credentials are not already cached). Combine with a pre-written `/etc/hosts` entry or run `sudo -v` first.
 
 Verify:
 
@@ -65,7 +83,33 @@ obol agent list
 obol agent auth obol-agent
 ```
 
-`obol stack up` provisions the cluster, auto-detects your local Ollama models into the LiteLLM gateway, deploys the default Hermes agent (with its own wallet behind a remote signer), and starts a Cloudflare quick-tunnel. From here you can chat with your agent locally at `http://obol.stack:8080` — or go straight to selling.
+`obol stack up` provisions the cluster, auto-detects host Ollama models into the **LiteLLM** gateway (when present), and deploys the default **Hermes** agent with its own wallet behind a remote signer. The Cloudflare tunnel stays **dormant** until the first sell workflow (or `obol tunnel restart` / `obol tunnel setup`).
+
+### Local UI URL (Host header)
+
+Open the frontend at:
+
+```text
+http://obol.stack:8080
+```
+
+Use **`obol.stack`**, not `localhost`. Traefik routes the frontend (and eRPC) only for `Host: obol.stack`. `http://localhost:8080` returns **404** even when the stack is healthy.
+
+- Prefer `:8080` on macOS when port 80 is unavailable (or after editing `k3d.yaml` to drop privileged 80/443 binds).
+- If port 80 is mapped, `http://obol.stack/` works too.
+
+Hermes dashboard (root edge-redirects to the password form):
+
+```text
+http://obol-agent.obol.stack
+```
+
+(or with `:8080` when that is your ingress)
+
+- **Username:** `obol`
+- **Password:** the agent API token from `obol agent auth obol-agent`
+
+Details: [Hermes dashboard login](docs/guides/hermes-dashboard-login.md).
 
 ## Sell: Your First Paid Service
 
@@ -406,7 +450,19 @@ Edit `~/.config/obol/k3d.yaml`, remove the `80:80` and `443:443` port entries (k
 obol stack down && obol stack up
 ```
 
-Access at http://obol.stack:8080 instead.
+Access at http://obol.stack:8080 instead (still with the `obol.stack` host — not `localhost`).
+
+#### `/etc/hosts` / sudo prompts
+
+`obol stack up` also tries to refresh managed hostnames (`obol.stack`, `obol-agent.obol.stack`, …). A failed hosts write is a **warning**, not a hard stop — the cluster still comes up. Fix hosts, then re-run `obol stack up` or `obol agent sync` so agent hostnames are registered.
+
+```bash
+# Minimal manual entry
+echo "127.0.0.1 obol.stack" | sudo tee -a /etc/hosts
+
+# Skip interactive sudo during automation (must already have NOPASSWD or a cached timestamp)
+OBOL_NONINTERACTIVE=true obol stack up
+```
 
 #### Monetize Flow Preflight
 

cmd/obol/bootstrap.go

@@ -31,7 +31,7 @@ func bootstrapCommand(cfg *config.Config) *cli.Command {
 
 			// Step 1: Initialize stack
 			backendName := stack.DetectExistingBackend(cfg)
-			if err := stack.Init(cfg, u, false, backendName); err != nil {
+			if err := stack.Init(cfg, u, false, backendName, false); err != nil {
 				if !strings.Contains(err.Error(), "already exists") {
 					return fmt.Errorf("bootstrap init failed: %w", err)
 				}

cmd/obol/main.go

@@ -190,9 +190,14 @@ GLOBAL OPTIONS:{{template "visibleFlagTemplate" .}}{{end}}
 								Usage:   "Cluster backend: k3d (Docker-based) or k3s (bare-metal)",
 								Sources: cli.EnvVars("OBOL_BACKEND"),
 							},
+							&cli.BoolFlag{
+								Name:    "yes",
+								Aliases: []string{"y"},
+								Usage:   "Skip the live-services confirmation prompt when --force switches backends (required in non-interactive shells when offers are running)",
+							},
 						},
 						Action: func(ctx context.Context, cmd *cli.Command) error {
-							return stack.Init(cfg, getUI(cmd), cmd.Bool("force"), cmd.String("backend"))
+							return stack.Init(cfg, getUI(cmd), cmd.Bool("force"), cmd.String("backend"), cmd.Bool("yes"))
 						},
 					},
 					{
@@ -212,6 +217,11 @@ GLOBAL OPTIONS:{{template "visibleFlagTemplate" .}}{{end}}
 							// Replay recorded remote RPC upstreams into the
 							// (possibly fresh) eRPC ConfigMap. Best-effort.
 							network.ReconcileRecordedRPCs(cfg, u)
+							// Re-apply durable multi-upstream eRPC operator
+							// overlays (baskets/scoring/rate-limits) AFTER
+							// simple recorded remotes. Best-effort.
+							// See ObolNetwork/obol-stack#763.
+							network.ReconcileERPCOverlay(cfg, u)
 							// Re-apply recorded Agent CRs BEFORE sell offers:
 							// agent-backed ServiceOffers resolve agent.ref and
 							// would dangle without their Agent. Best-effort.

cmd/obol/network.go

@@ -76,6 +76,7 @@ func networkCommand(cfg *config.Config) *cli.Command {
 			networkAddCommand(cfg),
 			networkRemoveCommand(cfg),
 			networkStatusCommand(cfg),
+			networkERPCCommand(cfg),
 		},
 	}
 }
@@ -534,6 +535,91 @@ func networkStatusCommand(cfg *config.Config) *cli.Command {
 	}
 }
 
+// network erpc — durable operator eRPC config that survives stack up (#763).
+// Verbs match sell-info set/reset (host-side intent) + status.
+// ---------------------------------------------------------------------------
+
+func networkERPCCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "erpc",
+		Usage: "Manage durable operator eRPC config (host-side; re-applied on stack up so local baskets are not lost)",
+		Commands: []*cli.Command{
+			{
+				Name:  "set",
+				Usage: "Set durable eRPC config from a YAML file and merge it into the live ConfigMap",
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:     "file",
+						Aliases:  []string{"f"},
+						Usage:    "YAML fragment: networks, upstreams, rateLimiters, cachePoliciesAdd (saved to $CONFIG_DIR/rpc/erpc-overlay.yaml)",
+						Required: true,
+					},
+				},
+				Action: func(_ context.Context, cmd *cli.Command) error {
+					return network.SetERPC(cfg, getUI(cmd), cmd.String("file"))
+				},
+			},
+			{
+				Name:  "status",
+				Usage: "Show the durable eRPC config on disk",
+				Action: func(_ context.Context, cmd *cli.Command) error {
+					u := getUI(cmd)
+					st, err := network.StatusERPC(cfg)
+					if err != nil {
+						return err
+					}
+					u.Printf("eRPC operator config\n")
+					u.Printf("====================\n\n")
+					u.Printf("Path: %s\n", st.Path)
+					if !st.Present {
+						u.Info("Status: not set")
+						u.Info("Set with: obol network erpc set -f <file.yaml>")
+						return nil
+					}
+					u.Printf("Status: set (v%d, hash %s)\n", st.Version, st.ContentHash)
+					switch st.ClusterSync {
+					case "":
+						u.Info("Cluster: unknown (could not reach cluster to check for drift)")
+					case network.ERPCSyncInSync:
+						u.Info("Cluster: in-sync")
+					case network.ERPCSyncNotApplied:
+						u.Warn("Cluster: not-applied (overlay is on disk but not on the live ConfigMap — run `obol network erpc set -f <file>` or `obol stack up`)")
+					default:
+						u.Warnf("Cluster: %s (live ConfigMap does not match the on-disk overlay — re-run `obol network erpc set -f <file>`)", st.ClusterSync)
+					}
+					u.Printf("Networks (%d):\n", st.NetworkCount)
+					for _, k := range st.NetworkKeys {
+						u.Printf("  - %s\n", k)
+					}
+					if st.NetworkCount == 0 {
+						u.Info("  (none)")
+					}
+					u.Printf("Upstreams (%d):\n", st.UpstreamCount)
+					for _, id := range st.UpstreamIDs {
+						u.Printf("  - %s\n", id)
+					}
+					if st.UpstreamCount == 0 {
+						u.Info("  (none)")
+					}
+					u.Printf("Rate-limit budgets: %d\n", st.BudgetCount)
+					u.Printf("Cache policies to add: %d\n", st.CachePolicyAdd)
+					return nil
+				},
+			},
+			{
+				Name:  "reset",
+				Usage: "Reset durable eRPC config (strip from live ConfigMap and delete host file)",
+				Action: func(_ context.Context, cmd *cli.Command) error {
+					return network.ResetERPC(cfg, getUI(cmd))
+				},
+			},
+		},
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return cli.ShowSubcommandHelp(cmd)
+		},
+	}
+}
+
 // chainIDToName returns a human-readable name for a chain ID.
 func chainIDToName(chainID int) string {
 	names := map[int]string{
@@ -550,6 +636,7 @@ func chainIDToName(chainID int) string {
 		43114:    "Avalanche",
 		59144:    "Linea",
 		84532:    "Base Sepolia",
+		999:      "HyperEVM",
 		534352:   "Scroll",
 		560048:   "Hoodi",
 		11155111: "Sepolia",